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This listing of claims replaces all prior versions, and 
listings of claims in the instant application: 

Listing of Claims: 

1. (Currently amended) A system comprising: 
a security management system comprising: 
a processor; and 

a memory coupled to said processor, said memory 
having stored therein a network security feedback and 
control system; a network occurity feedback and 
control oygtom wherein said network security feedback 
and control system receives a plurality of normalized 
events and issues at least one normalized command in 
response to a predefined event in said plurality of 
normalized events; 

a security management agent coupled to said security 
management system wherein said security management agent t ± 
collects normalized events generated by one or more 
managed products and forwards said normalized events to 
said security management system, further wherein said 
security management agent receives normalized commands 
from said security management system and forwards said 
normalized commands to at least one managed product; and 

at least one managed product coupled to said security 
management agent wherein said at least one managed product 
generates and transfers at least one normalized event to 
said security management agent . 
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2. (Original) The system of Claim 1 wherein said network 
security feedback and control system comprises: 

a feedback and control manager wherein said feedback 
and control manager processes said at least one normalized 
event and generates said at least one normalized command. 
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3. (Original) The security management system of Claim 2 
wherein said feedback and control manager includes at least one. 
rules engine wherein said rules engine includes a rule having a 
condition object that uses information from said at least one . 
normalized event. 



4. (Original) The system of Claim 1 further comprising: 

a managed node coupled to said security management 
system. 

5. (Previously presented) The system of Claim 4 wherein 
said managed node further comprises: 

said security management agent executing on said 
managed node . 

a 

6. (Previously presented) The system of Claim 5 wherein 
said at least one managed product receives normalized commands 
from said security management agent. 



7. (Cancelled) 

8. (Cancelled) 
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(Currently amended) A system comprising: 
a processor; and 

a memory coupled to said processor, said memory 



having stored therein an event subscription filter and a 21 
feedback and control manager coupled to said event 
subscription filter; 

an event subscription filter, wherein said event 
subscription filter for receiving receives a plurality of 
normalized events, generated by one or more managed 
products, from a security management agent and for passing 
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passes normalized events, for which said system is 
registered, to a said feedback and control manager; and 

a feedback and control manager coupled to oaid event 
oubocription filter, wherein said feedback and control 
manager processes at least one normalized event received 
from said event subscription filter and issues at least 
one normalized command to at least one security management 
agent for passing to at least one of said one or more 
managed products for use in dynamically implementing a 
predefined security policy. 

10. (Original) The system of Claim 9 further comprising: 
a knowledge database coupled to said feedback and 

control manager. 

11. (Original) The system of Claim 9 further comprising: 
a directory coupled to said feedback and control 

manager . 

12. (Original) The system of Claim 11 further 
comprising: 

a configuration adapter connected between said 
feedback and control manager and said directory. 

13. (Original) The system of Claim 9 wherein said 
feedback and control system further comprises a rules engine 
coupled to said event subscription filter. 

14. (Original) The system of Claim 9 further comprising: 
a security management agent coupled to said event 

subscription filter. 
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15. (Previously presented) The system of Claim 14 
further comprising: 
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at least one managed product coupled to said security 
management agent . 

16. (Previously presented) A method comprising: 

receiving a plurality of normalized events generated 
by managed products by a network security feedback and 
control system from a security management agent; and 

using information in said plurality of normalized 
events by said network feedback and control system in 
dynamically implementing a predefined security policy by 
issuing at least one normalized command in response to a 
predefined event in said plurality of normalized events to 
a security management agent for passing to at least one 
managed product . 



17. (Currently amended) A computer-program product 
comprising a tangible computer- readable medium configured to 
store containing computer program code for a method comprising: 

receiving a plurality of normalized events generated 
by managed products by a network security feedback and 
control system from a security management agent; and 

using information in said plurality of normalized 
events by said network feedback and control system in 
dynamically implementing a predefined security policy by 
issuing at least one normalized command in response to a 
predefined event in said plurality of normalized events to 
a security management agent for passing to at least one 
managed product . 

18. (Currently amended) A otructurc computer system ?: 
comprising: 

a processor; and 
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a memory coupled to said processor; said memory 
having stored therein a security management system, said • 
security management system comprising: 

means for receiving a plurality of normalized 
events generated by managed products by a network 
security feedback and control system from a security 
management agent ; and 

means for using information in said plurality of 
normalized events by said network feedback and 
control system in dynamically implementing a 
predefined security policy by issuing at least one 
normalized command in response to a predefined event 
in said plurality of normalized events to a security 
management agent for passing to at least one managed: 
product . 

Claims 19-67. (Cancelled) 



I. 
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